Why resilient supply chains need greater risk awareness and AI

The risk discussion centered on a more fragmented and uncertain operating environment. Leaders described a world in which regionalization does not necessarily remove risk; hidden dependencies are harder to detect; and tariff, trade policy, geopolitical and regulatory uncertainty are consuming more executive attention. As a result, organizations are increasingly planning for an uncertain future rather than repeating past playbooks. The discussion centered around three themes:

1. The traditional model of global supply chains is giving way to a more fragmented reality. “The age of one global linear supply chain is long gone,” said Dutta. “The default answer over the last 10 years is to go to multiple supply chains, but in reality, it trades one risk for another.” Surveying the growing bipartisan antipathy toward free trade in Washington today, another executive in chemicals said: “Everything cannot go back to being regional. The scale and cost doesn’t work. There has to be future-state interdependence globally.” The discussion suggested that organizations need to look beyond visible supplier tiers and map the vulnerabilities that could be used against companies or economies during periods of stress.

Which of the following scenarios is consuming the most leadership bandwidth in your organization today?

(Multiple choice)

2. Hidden dependencies have become one of the most significant enterprise risks. Leaders highlighted that the disruptions we’re planning for today are the ones we experienced in the past, while the future points to a potential erosion of US dominance, the troubling impacts of climate change and more that we can’t even imagine yet. Leaders warned that many of the most material risks are embedded in dependencies that do not appear obvious in traditional supply-chain reviews. These include concentrated sources of raw materials, infrastructure bottlenecks and critical inputs that have migrated to specific regions over decades. “We’ve allowed these dependencies to potentially be used against us as companies or nations,” one leader noted.

3. Trade, regulatory and geopolitical uncertainty consume the most executive attention. Among the 13 supply chain leaders who participated, most cited tariff, trade policy and regulatory uncertainty as the sore point that consumes the most leadership bandwidth today — but the disruptions of war, threats to digital infrastructure and logistics problems all loomed large as well. COVID-19 came up repeatedly in the conversation, yet the disorder long predated the pandemic and is resonating into the future just as persistently.

No C-suite discussion is complete without addressing the role of AI in business. Participants did not treat AI simply as a productivity tool; they discussed its potential to lower the enterprise risk profile, improve decision quality, sense weak signals and connect risk components across functions — while also recognizing that operationalizing AI introduces its own governance, cost and change-management challenges.

The discussions about AI happening in C-suites are evolving, said Juan Uro, EY Americas Leader for the CEL, based on his discussions with leaders across the world. “Companies were encouraging experimentation and then adoption,” he noted. “Lately, it’s been scaling up — and guess what? Scaling up costs money.”

The days of bottom-up adoption are yielding to top-down priorities in the right places to drive transformative growth, in which the costs are projected more astutely and the governance and operating models are updated accordingly. The group discussed three aspects of AI-led risk management.

1. AI may help leaders “listen” for and sense weak risk signals and emerging vulnerabilities earlier. AI may help leaders identify patterns, sentiment shifts and emerging vulnerabilities before they become obvious operational issues. “The technology can help us look around those corners, perhaps even entertain risks that we haven’t contemplated before,” one COO in consumer goods said. “I do think AI just to extract cost out of less meaningful tasks is important, but it’s the strategy beyond that.”

2. AI can increase capacity and decision quality in the risk agenda, beyond narrow cost reduction. Supply chain leaders understood that AI presented a much bigger opportunity than just a means to reduce labor costs. “We’ve moved so much transactional work into GDS, so the ROI on AI is not there,” a COO in chemicals said. “The big opportunity is increasing bandwidth to get more done with the same team. We can do three bids in a buy with agents working for the sourcing manager so that person can do more, for example, which lets us manage more spend than we’ve ever before.” Another agreed: “Our strategy has been not to approach this as an efficiency play. We’re using it for quality and speed of decision-making.” Another executive cited another rationale for AI adoption that will become more crucial in the future: declining birth rates. “Our population isn’t growing anymore,” she said. “In Western geographies, that’s real now. It’s necessary to think about how we integrate agentic AI in smart ways.” Another supply chain leader in manufacturing summed up the potential of AI: “It can work 24 hours a day and handle so many sources of data at the same time, so it’s suited for much more than getting a résumé written in a few minutes. People aren’t thinking of AI differently from a faster optimizer. But it’s what we’ve all been dreaming of for years; it can do things that people can’t, systematically.”

3. Operationalizing AI requires top-down governance, cost discipline and change management. Within supply chain, Dutta urged executives to widen the lens on what AI can do beyond the narrow bounds of cost reduction, which forces executives into a discussion on value and how it’s derived, by re-engineering processes and rethinking operating models. And what would a hybrid agentic/human workforce tackle in supply chain? The emerging opportunity is in risk. A former COO described what he’s seeing as a board member. “We were asking questions about cost reductions to pay for AI, and now we’re asking: How can AI lower our risk profile?” he said. “As supply chain professionals, working with CFOs and others, how do you work collectively to look at risk areas that can be combined and then reduce your liability with AI?” Uro also noted that boards want to engage with COOs and CIOs between the quarterly meetings to pressure-test how well risk components are connected across functions.

Nonetheless, the fear factor among employees today is acute. “When you get beyond ‘write me an email’ or something like that, it’s a huge change management issue to get people to engage and work cross-functionally and build agents, because people feel threatened by it,” the supply chain leader of a manufacturer said. Another added: “We still have a percentage of people who are scared about this, while others have AI’d their entire job, so we’ve found other work for them to do. On agents, I draw on the analogy of collaborative robots in manufacturing, which were supposed to be a jobs-killer. But today we have more manufacturing jobs than before cobots came along.”

The resilience discussion shifted from business continuity planning designed to manage more routine disruption to the more existential question of what the enterprise must preserve on its worst day — increasingly a question facing leaders as they grapple with a growing incidence of shock events not least of which are the threats posed by frontier AI-enabled cyber attacks. Leaders focused on defining non-negotiable commitments, identifying the minimum capabilities needed to sustain them, building preparedness through ownership, leading indicators, dry runs and measurable recovery commitments. The primary takeaways from the discussion include:

1. The key question is whether the enterprise can operate on its worst day. “The biggest question we’re getting from boards and C-suites is: ‘Are we ready for our worst day?’” said Kyle Lawless, EY Americas Enterprise Resilience Solution Leader. “It looks different for every organization. Can they secure materials? Can they produce? Delegate duties and pay employees? What are the promises that can’t be broken even on that worst day?”

2. The minimum viable enterprise is the bedrock of resilience. Lawless emphasized the concept of MVE: the smallest, leanest version of a function to deliver upon its most crucial mission even under the worst circumstances. One executive spoke openly of potentially being forced to go back to an “analog world”: “As we become more digital and overlay more AI, it wouldn’t take much to have a bad actor come in and shut us down.” One EY client experienced a cyber attack but was able to keep product on shelves through a paper-based system, Lawless said, offering a vivid example of what must be done when the technology we all rely on daily collapses. “They delivered 80% sales without any electronic inventory management,” Lawless said. “For any shock, we start with what promises must be maintained and go through the processes and governance, the people, the technology and data, the facilities and equipment, and the third parties. That’s the MVE ready to deliver on the worst day.”

3. The best resilience programs identify risks early and prepare responses in advance. One leader described his conception of MVE, implemented in the dark days of COVID-19: “We created a table with about 18 risks. We then looked at those and said: ‘Which are catastrophic? Which will disrupt us, but we’ll make it through? Which are highly unlikely?’ We decided on duplicate capabilities or plans on the shelf to execute if that happens. And the final piece is we assigned individuals and one of the key signals to be watching for to tell us whether that risk is materializing. We built a room that when one of these risks materializes, we get in there.”

4. Resilience must become an operational capability with measurable outcomes. Another manufacturing COO spoke up about his MVE metrics: “We get supply at 80% throughput for 96 hours when there is a problem. I have a deal that we will recover our systems within 96 hours. It’s the commitment and throughput that will measure success. You do dry runs based on that.”

Combined with MVE, supply chain leaders surfaced these tactics for resilience:

• Scenario planning as a way to look ahead. This accelerates organizational agility and decision speed, which are capability differentiators. “Our company also uses case studies and learns from them,” one executive said.
• Rehearsing disruptions before they happen. Exercises and organizational muscle memory can help companies respond faster, moving the resilience agenda from static planning toward “progility,” or proactive agility, as a consumer products COO calls it. “We create the capacity to deal with disruptions every day,” he said. “We can flow capacity when and where it happens. We rehearse on that.”
• Useful redundancy and optionality and reversible decisions. “The only strategy that makes somewhat sense is to be a little more agile and create two-way doors wherever you can,” another leader said. “With suppliers and your own manufacturing operations, you have to ask: Do you really want to close this door?”
• Broader C-suite connection. “Relationships across functions, between the COO and others, will become more relevant in how to apply capital allocation to protect against black-swan events,” another executive noted.
• Be active in public policy debates. A regulatory shift in a foreign nation prompted a crisis at the organization of one COO. “Policy-driven decisions affected our most important asset,” he said. “With the change in laws, we’re putting a lot of work into understanding the impact on the business and how we can influence public policy and ESG efforts.”